# CVE-2026-107161: Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients CVE-2026-107161 is fixed in 27 products on 1 platform, first by DEBIAN-CVE-2026-107161, released October 19, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-107161 - Priority: High - CVSS: 7.5 (Important) - EPSS: 0.0038 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Oct 7, 2026 - Weakness: Heap-based Buffer Overflow - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-107161 ## Description A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | cyrus-sasl amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl opensuse-leap 16.0 | 2.1.28-160000.4.1 | [OPENSUSE-SU-2026:22146-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22146-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl sles 15.6 | 2.1.28-150600.7.17.1 | [SUSE-SU-2026:4836-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4836-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl sles 15.7 | 2.1.28-150600.7.17.1 | [SUSE-SU-2026:4836-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4836-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl sles 16.0 | 2.1.28-160000.4.1 | [SUSE-SU-2026:24266-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24266-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl-bdb opensuse-leap 16.0 | 2.1.28-160000.4.1 | [OPENSUSE-SU-2026:22146-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22146-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl-bdb sles 15.6 | 2.1.28-150600.7.17.1 | [SUSE-SU-2026:4836-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4836-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl-bdb sles 15.7 | 2.1.28-150600.7.17.1 | [SUSE-SU-2026:4836-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4836-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl-debuginfo amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-debugsource amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-devel amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-devel-debuginfo amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-gs2 amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-gs2-debuginfo amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-gssapi amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-gssapi-debuginfo amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-ldap amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-ldap-debuginfo amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-lib amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-lib-debuginfo amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-md5 amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-md5-debuginfo amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-ntlm amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-ntlm-debuginfo amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-plain amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-plain-debuginfo amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-saslauthd opensuse-leap 16.0 | 2.1.28-160000.4.1 | [OPENSUSE-SU-2026:22146-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22146-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl-saslauthd sles 15.6 | 2.1.28-150600.7.17.1 | [SUSE-SU-2026:4836-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4836-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl-saslauthd sles 15.7 | 2.1.28-150600.7.17.1 | [SUSE-SU-2026:4836-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4836-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl-saslauthd sles 16.0 | 2.1.28-160000.4.1 | [SUSE-SU-2026:24266-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24266-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl-saslauthd-bdb opensuse-leap 16.0 | 2.1.28-160000.4.1 | [OPENSUSE-SU-2026:22146-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22146-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl-saslauthd-bdb sles 15.6 | 2.1.28-150600.7.17.1 | [SUSE-SU-2026:4836-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4836-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl-saslauthd-bdb sles 15.7 | 2.1.28-150600.7.17.1 | [SUSE-SU-2026:4836-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4836-1.md) | Nov 7, 2026 | | Linux | cyrus-sasl-scram amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-scram-debuginfo amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-sql amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl-sql-debuginfo amzn 2023 | 2.1.27-18.amzn2023.0.4 | [ALAS2023-2026-3290](https://patchblox.com/security/data/fix/linux/alas2023-2026-3290.md) | Nov 7, 2026 | | Linux | cyrus-sasl2 Debian 12.15 (bookworm) | 2.1.28+dfsg-10+deb12u1 | [DEBIAN-CVE-2026-107161](https://patchblox.com/security/data/fix/linux/debian-cve-2026-107161.md) | Oct 19, 2026 | | Linux | cyrus-sasl2 Debian 14 | 2.1.28+dfsg1-12 | [DEBIAN-CVE-2026-107161](https://patchblox.com/security/data/fix/linux/debian-cve-2026-107161.md) | Oct 19, 2026 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.